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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was established by 
the Homeland Security Act of 2002 (Public Law 107-296) by amendment to the Inspector General 
Act of 1978. This is one of a series of audit, inspection, and special reports prepared as part of our 
oversight responsibilities to promote economy, efficiency, and effectiveness within the department. 

This report represents the management letter for the audit of the Transportation Security 
Administration's (TSA) consolidated balance sheet as of September 30, 2008. It contains 
observations and recommendations related to internal controls that did not reach the level of 
materiality to be reported in the financial statement report. Other internal control deficiencies which 
are considered significant or material were reported, as required, in KPMG LLP's Independent 
Auditors ' Report, dated March 6, 2009, that was included in TSA's FY 2008 Performance and 
Accountability Report. The independent public accounting firm KPMG performed the audit and 
prepared this management letter, and is responsible for the attached management letter dated March 
25, 2009 and the conclusions expressed in it. We do not express opinions on TSA's financial 
statements, internal controls, or provide conclusions on compliance with laws and regulations. 

The recommendations herein have been discussed in draft with those responsible for 
implementation. We trust this report will result in more effective, efficient, and economical 
operations. We express our appreciation to all of those who contributed to the preparation of this 
report. 




Richard L. Skinner 
Inspector General 



KPMIG LLP 

2001 M Street, NW 
Washington, DC 20036 



March 25, 2009 

Office of Inspector General and Chief Financial Officer, 
U.S. Department of Homeland Security 
Transportation Security Administration 
Washington, DC 

Ladies and Gentlemen: 

We have audited the balance sheet of the U.S. Department of Homeland Security, Transportation 
Security Administration (TSA) as of September 30, 2008. We were not engaged to audit the 
statements of net cost, changes in net position, and budgetary resources, for the year ended September 
30, 2008 (referred to herein as "other fiscal year 2008 financial statements"). In our opinion, except 
for the effects of adjustments, if any, that might have been necessary had we been able to apply 
sufficient audit procedures to general property and equipment balances, and future minimum lease 
payments, the consolidated balance sheet referred to above presents fairly, in all material respects, the 
financial position of TSA as of September 30, 2008, in conformity with U.S. generally accepted 
accounting principles. 

In connection with our fiscal year (FY) 2008 audit, we were also engaged to consider TSA's internal 
controls over financial reporting, and TSA's compliance with certain provisions of applicable laws, 
regulations, contracts, and grant agreements that could have a direct and material effect on the balance 
sheet. Our procedures did not include examining the effectiveness of internal control and do not 
provide assurance on internal control. We have not considered internal control since the date of our 
report. 

We noted certain matters involving internal control and other operational matters that are summarized 
in the Table of -Financial Management Comments and presented for your consideration. These 
comments and recommendations, all of which have been discussed with the appropriate members of 
management, are intended to improve internal control or result in other operating efficiencies. These 
comments are in addition to the significant deficiencies presented in our Independent Auditors ' 
Report, dated March 6, 2009, included in the FY 2008 TSA Annual Financial Report. A description 
of each internal control finding and its disposition as either a significant deficiency or a financial 
management comment is provided in Appendix A. The status of our prior year notice of findings and 
recommendations are provided in Appendix B. Our findings related to information technology 
systems security have been presented in a separate letter to the Office of Inspector General and the 
TSA Chief Information Officer. 

As described above, TSA was unable to fully support the accuracy and completeness of certain general 
property and equipment balances and related effects on net position, if any, prior to the completion of 
TSA's FY 2008 Annual Financial Report „ We were not engaged to audit the statements of net cost, 
changes in net position, and budgetary resources for the year ended September 30, 2008. Accordingly, 
other internal control matters and other instances of non-compliance may have been identified and 
reported had we been able to perform all procedures necessary to express an unqualified opinion on 
the fiscal year 2008 balance sheet and had we been engaged to audit the other fiscal year 2008 
financial statements. We aim, however, to use our knowledge of TSA's organization gained during 
our work to make comments and suggestions that we hope will be useful to you. 



mm 



We would be pleased to discuss these comments and recommendations with you at any time. 

This report is intended for the information and use of TSA management, the Office of Inspector 
General, the U.S. Office of Management and Budget, the U.S. Congress, and the Government 
Accountability Office, and is not intended to be and should not be used by anyone other than these 
specified parties. TSA's response to the findings identified in our audit, and reported herein, is 
presented in Appendix C. We did not audit TSA's response and, accordingly, we express no 
opinion on it. 

Very truly yours, 



Transportation Security Administration 
Table of Financial Management Comments 
September 30, 2008 
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Transportation Security Administration 
Financial Management Comments 
September 30, 2008 



TSA FMC 08-01 (NFR No. TSA 08-05) - Undelivered orders documentation 

While auditing undelivered orders we noted that: 

• TSA lacks sufficient internal controls to ensure contract management policies and procedures 
are being adhered too. Specifically, we noted the following instances where contract 
management policies and procedures failed: 

o Two instances where the period of performance of the obligation was not extended until 

after the expiration of the original period of performance, 
o Three instances of an expenditure's billing period extending beyond or outside the period 

of performance of the obligation, 
o One instance of an untimely deobligation related to a contract whose period of 

performance had expired over six months earlier. 

« Expenditures were not evaluated to determine if they related to capitalizable activity. 
Specifically, we noted two instances where assets purchased over the established 
capitalization threshold of $50,000 did not appear on the Sunflower Capitalized Asset list as 
of September 30, 2008. 

• Proper adherence to the travel policy did not occur in all instances. Specifically, we noted 36 
instances where a travel authorization was not recorded prior to travel. 

Recommendations: 

We recommend that TSA: 

1 . Implement sufficient internal controls to ensure that contract management policies and 
procedures are being followed. 

2. Implement sufficient internal controls to ensure polices and procedures are followed to ensure 
that expenditures that relate to capitalizable activity are capitalized. 

3. Implement sufficient internal controls to ensure that travel policies and procedures are being 
followed. 

TSA FMC-08-02 (NFR No. TSA 08-10) - Required Supplementary Information 

We noted that during FY 2008, TSA has made efforts to enhance report outcomes and outputs as 
required by Office of Management and Budget (OMB) Circular A- 1 36, Financial Reporting 
Requirements, for Required Supplementary Stewardship Information (RSSI), specifically 
investments in human capital and research and development. We noted that although efforts have 
been made, TSA was unable to obtain all necessary support. 

Recommendation: 

We recommend that TSA develop and implement procedures to develop and track relevant 
outcomes and outputs and report them as part of RSSI. 

TSA FMC-08-03 (NFR No. TSA 08-15) - Grant monitoring and compliance with OMB Circular 
No. A-133 

We noted that policies and procedures exist to monitor grantees' compliance with OMB Circular 
No. A-133, Audits of State, Local Governments, andNon-Profit Organizations; however, they 
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Transportation Security Administration 
Financial Management Comments 
September 30, 2008 

were not fully implemented during FY 2008. KPMG noted the following in our review of TSA's 
compliance with OMB Circular A- 133: 

* TSA's tracking database used to track grants, including those subject to the audit 

requirements in A-133, is incomplete. Specifically, this database does not include all grants 
which are required to have a Single Audit performed. 

« The dates in the grants database used to track the fiscal year end for grantees were incorrect 
or not included. 

« Evidence of TSA's review of all of the grantee's Single Audit reports listed in TSA's 
database was not noted in the database. 

Recommendations: 

We recommend that TSA continue its efforts started during the last quarter of FY 2008 to review 
all grants, and monitor the grants on a timely basis, tracking the fiscal year end of the grantee, the 
award amount, and the status of the most recent Single Audit reports. We also recommend that 
TSA put processes in place to continually monitor completeness over the listing of grants. This 
will ensure that all of TSA's grants are included in the grants database and are monitored for 
compliance. 

TSA FMC-08-04 (NFR No. TSA 08-18) - Ineffectiveness of controls over the time and attendance 
process 

We noted several instances where the T&A sheets were missing the approval signature of the 
employee. Upon further inquiry, it was noted that the employees were not available to review 
and sign their timesheet when it was required to be submitted because of shift conflicts or being 
on personal leave. Due to this, the supervisors approved the timesheet and the timesheet was 
entered into the webTA system without proper approval from the employee. Furthermore, even 
after being entered into webTA, the timesheet was never returned to the employee for review and 
approval. 

Recommendations: 

We recommend that TSA: 

1. Implement and follow an additional policy that requires employees to review and sign all 
timesheets. 

2. Mandate that timekeepers mark timesheets for review if the employee signature is absent and 
regularly follow up on such items until they are resolved. 

TSA FMC-08-05 (NFR No. TSA 08-20) - Incomplete listing of asset leases 

During our inventory observation procedures, we noted that one asset selected to verify its 
existence and inclusion in the annual property inventory was excluded from the Sunflower 
capitalized asset module. Upon inquiry with site management, the asset was identified as leased 
property, and therefore properly excluded from owned asset listing. However, we also noted that 
the asset was not included on the leased asset listing. 

Recommendations: 

We recommend that TSA develop and implement a policy to reasonably ensure that all leased 
assets are properly tracked. The policy should include: 

1 . Guidance to help identify equipment as leased assets and to maintain a listing of the assets; 

2. A requirement to perform periodic reviews to ensure completeness, and indicate the 
disposition of the asset when the lease expires. 
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Transportation Security Administration 
Financial Management Comments 
September 30, 2008 



TSA FMC-08-06 (NFR No. TSA 08-21) - Unauthorized transfer of assets 

TSA personnel did not always adhere to TSA policy requiring authorization and documentation 
to support all security equipment transfers between locations. We noted one instance where an 
asset was not in the airport location listed in TSA's records. The asset was listed to be in 
Jacksonville, FL (JAX), but was located at the Daytona Beach International Airport. TSA 
informed us that "no transfer documentation was available to support transfer of this asset from 
JAX to Daytona. The move was unauthorized." As such, in this instance TSA personnel did not 
adhere to the Office of Property Management's Security Equipment Movement Procedures. 

Recommendation: 

We recommend that TSA implement monitoring controls to ensure the existing policy in place 
regarding the transfer of assets is followed. 

TSA FMC-08-07 (NFR No. TSA 08-25) - SAS 70 review 

As of September 2008, TSA had not performed a review of its service providers' internal control 
report or evaluated the implications of the service providers' controls on TSA's control 
environment for FY 2008. Additionally, the review that was performed over the service 
organizations' FY 2007 controls did not evaluate the implications of the service providers' 
controls on TSA's control environment. During October 2008, TSA performed a review of its 
service providers' draft control report to determine any implications to the financial statements. 
Based on this review, no additional steps were identified. 

Recommendation: 

We recommend that TSA continue its review of its service providers' current year internal control 
reports on an annual basis and review updated and finalized reports as necessary. 
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Appendix A 

Transportation Security Administration 
Crosswalk of Financial Management Comments to NFRs 
September 30, 2008 



\ 1 Disposition 



IAR 



KMC 



Component 



NFR 
No. 



v - ^Description , 



MW 



,5D 



NC ; 



No. 



TSA 


08-01 


Number not used 


Not applicable 


TSA 


08-02 


Number not used 


Not applicable 


TSA 


08-03 


Number not used 


Not applicable 


TSA 


08-04 


Incorrect trading partner codes 


A 








TSA 


08-05 


Undelivered order documentation 








08-01 


TSA 


08-06 


Number not used 


Not applicable 


TSA 


08-07 


Number not used 


Not applicable 


TSA 


08-08 


Number not used 


Not applicable 


TSA 


08-09 


Financial reporting deficiencies 


A 








TSA 


08-10 


Required Supplementary Information 








08-02 


TSA 


08-11 


Debt Collection Improvement Act (DCIA) compliance 






E 




TSA 


08-12 


Number not used 


Not applicable 


TSA 


08-13 


Non-compliance with FFMIA 






A 




TSA 


08-14 


Non-compliance with FMFIA 


Reported at Consolidated 


TSA 


08-15 


Grant monitoring and compliance with OMB Circular No. A- 








08-03 


TSA 


08-16 


Non-Compliance with human resources related laws 






F 




TSA 


08-17 


Number not used 


Not applicable 


TSA 


08-18 


Ineffectiveness of controls over the time and attendance 
process 








08-04 


TSA 


08-19 


Policies and procedures to ensure compliance with GAAP 


A 








TSA 


08-20 


Incomplete listing of asset leases 








08-05 


TSA 


08-21 


Unauthorized transfer of assets 








08-06 


TSA 


08,22 


Warehouse property impairment 


B 








TSA 


08-23 


Policies and procedures for evaluating non-GAAP policies 


A 








TSA 


08-24 


Review of journal vouchers 


A 








TSA 


08-25 


SAS 70 review 








08-07 


TSA 


08-26 


Incorrect classification of obligations as Fed or non-Fed 


A 








TSA 


08-27 


Accounts payable 


A 








TSA 


08-28 


Reporting ofPP&E 


A, B 








TSA 


08-29 


Entity-level controls 




D 






TSA 


08-30 


Accounting for Leases 


A 
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Transportation Security Administration 
Status of Prior Year NFRs 
September 30, 2008 



Appendix B 





, , 1 Disposition 


Component 


NFR 
No. 


Description 


Closed 


^epeiiil(08Wl No.) 


TSA 


07-01 


Leirers of imenc accrual for June 30, 2007 


X 




TSA 


07-02 


Accrued leave balances 


X 




TSA 


07-03 


PP&E depreciation 


X 




TSA 


07-04 


Incorrect trading partner codes 




TSA 08-04 


TSA 


07-05 


Undelivered order balances 




TSA 08-05 


TSA 


07-06 


Construction in Progress (CIP) 


X 




TSA 


07-07 


Reconciliation of property, plant, and equipment 


X 




TSA 


07-08 


Use of USSGL account 1890 


X 




TSA 


07-09 


Financial reporting deficiencies 




TSA 08-09 


TSA 


07-10 


Required Supplementary Stewardship Information 




TSA 08-10 


TSA 


07- U 


Debt Collection Improvement Act (DCIA) compliance 




TSA 08-11 


TSA 


07-12 


Allowance for Doubtful Accounts and Related Accounts 
Receivable Methodology 


X 




TSA 


07-13 


Non-compliance with FFMIA 




TSA 08-13 


TSA 


07-14 


Non-compliance with FMFIA 




TSA 08-14 


TSA 


07-15 


Grant monitoring and compliance with OMB Circular No. 
A-133 




TSA 08-15 


TSA 


07-16 


Non-Compliance with Human Resources Related Laws 




TSA 08-16 


TSA 


07-17 


Core Accounting System (CAS) Generated Accounts 
Payable 


X 
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Appendix C 

Transportation Security Administration 

Management Response to the Draft 
Management Letter 
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U.S. Department of Homeland Security 



Office of Finance and Administration 
601 South 12' h Street, TSA-14 
Arlington, VA 20598-6014 



MAR 1 9 2009 




Administration 



k Transportation 



Security 



Anne L. Richards 

Assistant Inspector General for Audits 
Department of Homeland Security 
Office of Inspector General 
245 Murray Drive SW 
Building 410 
Washington, DC 20528 

Dear Ms. Richards: 

Thank you for the opportunity to respond to comments addressed in the Financial Management 
Comment (FMC) Letter pertaining to the FY 2008 TSA Balance Sheet audit. We appreciate your 
staff and KPMG's efforts in assisting TSA in improving internal control and other operating 
efficiencies. 

As directed by DHS CFO, we have developed comprehensive Mission Action Plans (MAPs) in the 
areas of Financial Reporting, Property Management, Information Technology General Controls, 
Budgetary Accounting, and Human Capital. Corrective actions have been developed in response to 
your recommendations and have been included in our MAPs. 

Our actions for each of the recommendations are described below. 

TSA FMC 08-01 (NFR No. TSA 08-05) - Undelivered orders documentation. 

Recommendations: 

• Implement sufficient internal controls to ensure that contract management policies and 
procedures are being followed. 

TSA Response: Concur. The Office of Acquisition has hired a Policy Director and two federal 
employees who are actively reviewing and updating TSA's acquisition policies. The Office of 
Acquisition has begun offering policy workshops to educate agency staff and re-enforce the policies. 

• Implement sufficient internal controls to ensure policies and procedures are followed to ensure 
that expenditures that relate to capitalizable activity are capitalized. 

TSA Response: Concur. TSA, through the Property Integrated Project Team, is revising the policies 
and procedures for inputting capitalized assets into Sunflower to ensure costs are entered as part of 
the asset data. This is Critical Milestone #10.0 in our Property Management MAP. 

• Implement sufficient internal controls to ensure that travel policies and procedures are being 
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TSA Response: Concur. TSA's Office of Financial Management, Financial Policy, Travel, and 
Procedures (FPT&P) Branch is developing a report to identify travelers whose authorization was 
approved after travel began. They are developing a process to notify the appropriate personnel of 
the occurrence. The FPT&P Branch has also put in place a contract to perform travel voucher post- 
payment audits. These audits began in November 2008. An average of 670 vouchers per month 
(approximately 8000 per year) will be audited. The Internal Control Branch will also be performing 
audits on the post-payment audit process. In addition, all TSA employees will be reminded through 
a TSA-wide broadcast message concerning compliance with the travel policy requirements. The 
FPT&P Branch will also be re-enforcing the travel policy requirements during their periodic Policy 
Round Table and TeServ Point of Contact conference calls. A newsletter article concerning 
compliance with travel policies will be in the next Financial Management newsletter. 

TSA FMC-08-02 (NFR No. TSA 08-10) - Required Supplementary Information. 

Recommendation: 

• We recommend that TSA develop and implement procedures to develop and track relevant 
outcomes and outputs and report them as part of RSSI. 

TSA Response: Concur. TSA has developed MAP milestones to determine the TSA managed 
programs that are applicable to OMB A- 136. TSA also has developed milestones to develop the 
process and procedures for determining the RSSI information requirements and to ensure 
compliance. This is Critical Milestone # 7.0 in our Financial Reporting MAP. 

TSA FMC-08-03 (NFR No. TSA 08-15) - Grant monitoring and compliance with OMB 
Circular No. A-133. 

Recommendations: 

• We recommend that TSA continue its efforts started during the last quarter of FY 2008 to review 
all grants, and monitor the grants on a timely basis, tracking the fiscal year end of the grantee, 
the award amount, and the status of the most recent Single Audit reports. We also recommend 
that TSA put processes in place to continually monitor completeness over the listing of grants. 
This will ensure that all of TSA's grants are included in the grants database and are monitored 
for compliance. 

TSA Response: Concur. TSA's Office of Acquisition has hired an additional federal employee to 
assist in the monitoring and tracking of the grants. Also, additional verification audits by the Office 
of Acquisition and the Internal Control Branch have been put in place to ensure compliance with 
policies and procedures. 

TSA FMC-08-04 (NFR No. TSA 08-18) - Ineffectiveness of controls over the time and 
attendance process. 

Recommendations: 

• Implement and follow an additional policy that requires employees to review and sign all 
timesheets. 

• Mandate that timekeepers mark timesheets for review if the employee signature is absent and 
regularly follow up on such items until they are resolved. 
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TSA Response: Non-concur. The Office of Human Capital has determined that due to operational 
and scheduling issues in some locations and due to the administrative office not being open during 
some employees' work hours, that the employees' signature would not be required. The Office of 
Human Capital has modified their Time and Attendance Handbook to reflect that employees do not 
have to sign the T&A sheets if unavailable to sign. The Handbook is in the final approval stages 
with distribution and notification to timekeepers to be made by the end of March 2009. This is 
Critical Milestone # 4.0 in our Human Capital MAP. 

TSA FMC-08-05 (NFR No. TSA 08-20) - Incomplete listing of asset leases. 

Recommendations: 

• We recommend that TSA develop and implement a policy to reasonably ensure that all leased 
assets are properly tracked. The policy should include: 

• Guidance to help identify equipment as leased assets and to maintain a listing of the assets; 

• A requirement to perform periodic reviews to ensure completeness, and indicate the 
disposition of the asset when the lease expires. 

TSA Response: Concur. TSA will be reviewing and revising the policy for accounting for future 
minimum lease commitments to ensure compliance with FASB 13 requirements. A new Financial 
Reporting MAP milestone will be developed to address the recommendations. 

TSA FMC-08-06 (NFR No. TSA 08-2 J) - Unauthorized transfer of assets. 
Recommendation: 

• We recommend that TSA implement monitoring controls to ensure the existing policy in place 
regarding the transfer of assets is followed. 

TSA Response: Concur. TSA, through the Property Integrated Project Team, is revising the policies 
and procedures for field initiated transfers of equipment between field locations. Performance of a 
gap analysis of the equipment transfer process to include Sunflower update process is being 
performed. Update of the current process, including roles and responsibilities and Sunflower 
required transactions will be made. All appropriate TSA personnel will be trained on the new 
policies and procedures. The development of a periodic audit made by the Internal Control Branch 
will also be developed and implemented. This is Critical Milestone # 13.0 in the Property 
Management MAP. 

TSA FMC-08-07 (NFR No. TSA 08-25) - SAS 70 review. 
Recommendation: 

• We recommend that TSA continue its review of its service providers' current year internal 
control reports on an annual basis and review updated and finalized reports as necessary. 

TSA Response: Concur. TSA will be developing an annual SAS 70 review process and procedure. 
This procedure will include the identification of service providers which will require SAS 70. The 
procedure also includes the review and analysis of the SAS 70 or other assurances. If any 
weaknesses are identified, the procedure will require development of compensating controls. This is 
Critical Milestone # 4.0 in the Information Technology General Controls MAP. 
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If you have any questions concerning this response, please contact Jeffrey Bobich, Director, Office 
of Financial Management at 571-227-21 18 or ieffrev.bobich@,dhs.gov . 

Sincerely, 

•3 

David R. Nicholson 

Assistant Administrator and Chief Financial Officer 
Office of Finance and Administration 
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To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4199, 
fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 



OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 
misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigations - Hotline, 
245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 



The OIG seeks to protect the identity of each writer and caller. 



